Commit f24312982 for imagemagick.org
commit f243129822ba1a211a82754d3085b26a47d02706
Author: Cristy <urban-warrior@imagemagick.org>
Date: Thu May 14 08:09:49 2026 -0400
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xf64-q5rg-85g5
diff --git a/MagickCore/distribute-cache.c b/MagickCore/distribute-cache.c
index cfc07184c..f4376834a 100644
--- a/MagickCore/distribute-cache.c
+++ b/MagickCore/distribute-cache.c
@@ -762,6 +762,9 @@ static MagickBooleanType WriteDistributeCacheMetacontent(
p+=(ptrdiff_t) sizeof(region.y);
(void) memcpy(&length,p,sizeof(length));
p+=(ptrdiff_t) sizeof(length);
+ extent=((MagickSizeType) region.width*region.height*sizeof(Quantum));
+ if (length > extent)
+ return(MagickFalse);
q=GetAuthenticPixels(image,region.x,region.y,region.width,region.height,
exception);
if (q == (Quantum *) NULL)
@@ -786,6 +789,7 @@ static MagickBooleanType WriteDistributeCachePixels(SplayTreeInfo *registry,
count;
MagickSizeType
+ extent,
length;
Quantum
@@ -819,6 +823,10 @@ static MagickBooleanType WriteDistributeCachePixels(SplayTreeInfo *registry,
(void) memcpy(®ion.y,p,sizeof(region.y));
p+=(ptrdiff_t) sizeof(region.y);
(void) memcpy(&length,p,sizeof(length));
+ extent=((MagickSizeType) region.width*region.height*image->number_channels*
+ sizeof(Quantum));
+ if (length > extent)
+ return(MagickFalse);
p+=(ptrdiff_t) sizeof(length);
q=GetAuthenticPixels(image,region.x,region.y,region.width,region.height,
exception);